<?php

declare(strict_types=1);

namespace Sentinelo\Scanner\Checks;

use Sentinelo\Scanner\CheckResult;

class WpConfigCheck
{
    public function run(): CheckResult
    {
        try {
        $wpConfig = ABSPATH . 'wp-config.php';
        if (!file_exists($wpConfig)) {
            $wpConfig = dirname(ABSPATH) . '/wp-config.php';
        }

        if (!file_exists($wpConfig)) {
            return new CheckResult(
                'wp_config',
                'skip',
                0,
                5,
                'medium',
                ['error' => 'wp-config.php introuvable'],
                'Fichier wp-config.php non trouvé'
            );
        }

        $content = @file_get_contents($wpConfig);
        if ($content === false) {
            return new CheckResult(
                'wp_config',
                'skip',
                0,
                5,
                'medium',
                ['error' => 'Impossible de lire wp-config.php'],
                'Permissions insuffisantes pour lire wp-config.php'
            );
        }

        $issues = [];

        $keys = ['AUTH_KEY', 'SECURE_AUTH_KEY', 'LOGGED_IN_KEY', 'NONCE_KEY', 'AUTH_SALT', 'SECURE_AUTH_SALT', 'LOGGED_IN_SALT', 'NONCE_SALT'];
        foreach ($keys as $key) {
            if (preg_match("/define\s*\(\s*['\"]" . preg_quote($key, '/') . "['\"]\s*,\s*['\"](.+?)['\"]/", $content, $matches)) {
                $value = $matches[1];
                if (strpos($value, 'put your unique phrase here') !== false || strlen($value) < 32) {
                    $issues[] = ['issue' => 'Clé ' . $key . ' par défaut ou trop courte'];
                }
            }
        }

        // Check if wp-config.php is accessible via HTTP
        $testUrl = site_url() . '/wp-config.php';
        $response = wp_remote_get($testUrl, ['timeout' => 5]);
        $httpCode = is_wp_error($response) ? 0 : wp_remote_retrieve_response_code($response);
        if ($httpCode === 200) {
            $issues[] = ['issue' => 'wp-config.php accessible publiquement via HTTP'];
        }

        $score = empty($issues) ? 5 : max(0, 5 - count($issues));
        $status = empty($issues) ? 'pass' : 'warn';

        return new CheckResult(
            'wp_config',
            $status,
            $score,
            5,
            'high',
            $issues,
            empty($issues)
                ? 'Sécurité wp-config.php correcte'
                : sprintf('%d problème(s) dans wp-config.php', count($issues))
        );
        } catch (\Throwable $e) {
            return new CheckResult(
                'wp_config',
                'skip',
                5,
                5,
                'info',
                ['error' => $e->getMessage()],
                'Vérification ignorée (exception interne) : ' . $e->getMessage()
            );
        }
    }
}